CLAIMS 

What is claimed is: 

1 \ A computerized method for scanning files for viruses comprising: 

2 \ generating a current session key upon an execution of the method; 

3 \obtaining a session stamp associated with a directory entry for a file; 

4 scanning the file if the session stamp was created using a previous session key; and 

\ 

5 updating the session stamp as a result of the scan. 

1 2. The mertiohvpf claim 1, further comprising: 

2 scanning the fhp if there is no session stamp associated with the directory entry for 

3 the file; and "\ 

4 creating a session stdmp using the current session key as a result of the scan. 

1 3. The method of claim 1, wherein updating the session stamp comprises invalidating 

2 the session stamp if the file is infectecrwith a virus. 

1 4. The method of claim 1, wherein the session stamp comprises an infection indicator 

2 and updating the session stamp comprises modifying the infection indicator when the file is 

3 infected with a virus. \ 

1 5. The method of claim 1, wherein the session stam\ comprises a signature and 

2 updating the session stamp comprises encrypting a known value with the current session 

3 key to create the signature. \^ 

\ 
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1 ^6. The method of claim 1, wherein the session stamp comprises a signature and 

2 updating the session stamp comprises replacing a previous session key with the current 

3 sessron key. 

1 7. The method of claim 1, wherein the session stamp comprises context information 

2 and updating the session stamp comprises replacing previous context information with 

3 current context information. 



1 8. The methodSof claim 1, wherein obtaining the session stamp, scanning the file, and 

2 updating the session stamp are performed when the file is accessed. 

1 9. The method of clain\ 1, wherein obtaining the session stamp, scanning the file, and 

2 updating the session stamp arevperformed upon the file as a result of a user command. 

1 10. The method of claim 1, further comprising: 

2 loading a pre-determined set oKfile identifiers, wherein obtaining the session 

3 stamp, scanning the file, and updating theSsession stamp are performed on each file 

4 identified by the file identifiers. \ 

1 11. The method of claim 10, wherein the pre-determined set of file identifiers is a 

2 most-recently-used cache of identifiers for the files that have been most recently used, and 

3 further comprising: \ 

4 adding an identifier for the file to the most-recently-u^ed cache when the file is 

5 accessed; and \ 

6 storing the most-recently-used cache to non-volatile storagk upon termination of 

7 the execution. \ 
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1 ^he met hod of claim 10, wherein the pre-determined set of file identifiers is 

2 created from user input. 

1 13. Tne method of claim 10, wherein obtaining the session stamp, scanning the file, 

2 and updatingsthe session stamp are performed as a background task on each file identified 

3 by the file identifiers. 

1 14. The method of claim 1, wherein the session stamp is stored in an extended 

2 attributes section of the airectory entry for the file. 

1 15. A computer-readable medium having stored thereon executable instructions to 

2 cause a computer to perform a metiiod comprising: 

3 generating a current session key upon an execution of the instructions; 

4 obtaining a session stamp associated with a directory entry for a file; 

5 scanning the file if the session stamto was created using a previous session key; and 

6 updating the session stamp as a resulrof the scan. 

1 16. The computer-readable medium of claim 15V further comprising: 

1 scanning the file if there is no session stamp associated with the directory entry for 

2 the file; and \ 

3 creating a session stamp using the current session keysas a result of the scan. 

1 17. The computer-readable medium of claim 15, wherein obtaining the session stamp, 

2 scanning the file, and updating the session stamp are performed when the file is accessed. 
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1 r8. The computer-readable medium of claim 15, wherein obtaining the session stamp, 

2 scanning the file, and updating the session stamp are performed upon the file as a result of 

3 a usercommand. 

1 19. Thescomputer-readable medium of claim 15, further comprising: 

2 loading, a pre-determined set of file identifiers, wherein obtaining the session 

3 stamp, scanningthe file, and updating the session stamp are performed on each file 

4 identified by the file, identifier. 

1 20. The computer-readable medium of claim 15, wherein the session stamp is stored in 

2 an extended attributes section of the directory entry for the file. 

1 21. A computer-readable medium having stored thereon a session stamp data structure 

2 comprising: \ 

3 a file identifier field containing (Ma representing an identifier for a file in a file 

4 system; and \ 

5 a signature field containing data createV by an execution of an anti-virus process 

6 that last scanned the file identified by the file identifier field. 

1 22. The computer-readable medium of claim 21, wherein the data in the signature field 

2 represents a pre-determined value encrypted by a session Key associated with the 

3 execution of the anti-virus process. \ 

1 23. The computer-readable medium of claim 21, wherein the datk in the signature field 

2 represents a session key associated with the execution of the anti-virus process. 
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1 v4. The computer-readable medium of claim 21, further comprising: 

2 \ a scanner settings field containing data representing a configuration for the anti- 

3 viruk process that last scanned the file identified by the file identifier field. 

\ 

1 25. TJie computer-readable medium of claim 21, further comprising: 

2 a scVn result field containing data representing an infection status returned by the 

3 anti-virus process that last scanned the file identified by the file identifier field. 

1 26. The computer readable medium of claim 21, further comprising: 

2 a time and datfe stamp field containing data representing a time and date the file 

3 identified by the file identifier field was last modified. 

1 27. The computer-readableoriedium of claim 21, further comprising: 

2 a size field containing datV representing a size for the file identified by the file 

3 identifier field. \ 

1 28. A computer system comprising: \ 

2 a processor coupled to a system bus;\ 

3 a memory coupled to the processor through the system bus; 

4 a computer-readable medium coupled to tn& processor through the system bus; 

5 a virus scanning process executed from the coniputer-readable medium by the 

6 processor, wherein the scanning process causes the processor to generate a current session 

7 key when the scanning process is executed from the compuiisx-readable medium, and 

8 further to obtain a session stamp associated with a directory enW for a file from the 

9 computer-readable medium, to scan the file if the session stamp was created using a 
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10 previous session key, and to update the session stamp on the computer-readable medium 

1 1 as\a result of the scan. 

1 29. \ The computer system of claim 28, wherein the virus scanning process further 

2 causes me processor to scan the file if there is no session stamp associated with the 

3 directory entry for the file on the computer-readable medium, to create a session stamp 

4 using the current session key as a result of the scan, and to store the session stamp in the 

5 directory entryVor the file on the computer-readable medium. 

1 30. The computer system of claim 28, further comprising a user input device coupled 

2 to the processor throu^i the system bus, wherein input from the user input device 

3 instructs the virus scanning process to scan the file. 

1 31. The computer system of claim 28, further comprising an application process 

2 executed from the computer-readkble medium by the process, wherein a request from the 

3 application process for the file causes the processor to scan the file. 

1 32. A method for communicating between an anti-virus process and a session stamping 

2 process comprising: \ 

3 issuing, by the anti- virus process, an enable-session-key call; 

4 receiving, by the session stamping process\the enable-session-key call and, in 

5 response thereto, initializing a stamping session and generating a session key; 

6 issuing, by the anti- virus process, a disable-sessflon-key call; and 

7 receiving, by the session stamping process, the disable-session-key call and, in 

8 response thereto, disabling the stamping session. \ 
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1 33\^ The method of claim 32, further comprising: 

2 \ issuing, by the anti-virus process, a stamp-file-with-session-stamp call having a file 

3 parameter; and 

4 receiving, by the session stamping process, the stamp-file-with-session-stamp call 

5 and, in response thereto, generating a session stamp using the session key and associating 

6 the session star^> with a file identified by the file parameter. 

1 34. The method exclaim 33, wherein the stamp-file-with-session-stamp call further has 

2 an engine parameter identifying context information used to generate the session stamp. 

\ 

\ 

1 35. The method of claim "^3, wherein the stamp-file-with-session-stamp call further has 

2 an iam parameter identifying thaanti-virus process currently calling the session stamping 

3 process. \ 

1 36. The method of claim 32, furthepcomprising: 

2 issuing, by the anti-virus process, a\delete-session-stamp call having a file 

3 parameter; and \ 

4 receiving, by the session stamping process, the delete-session-stamp call and, in 

5 response thereto, deleting any session stamp associated with the file identified by the file 

6 parameter. \ 

1 37. The method of claim 32, further comprising: \ 

2 issuing, by the anti-virus process, a has-file-got-valid-session-stamp call having a 

3 file parameter; \ 
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ceiving, by the session stamping process, the has-file-got-valid-session-stamp call 
and, in respQnse thereto, determining a validity for any session stamp associated with the 
file identified Ek^ the file parameter; and 

returning, by the session stamping process, the validity to the anti-virus process. 

\ 

\ 
\ 

38. The method of cfojm 37, wherein the has-file-got-valid-session-stamp call further 
has an engine parameter identifying context information used to determine the validity of 



the session stamp. 



\ 



\ 



39. The method of claim 37, whereiathe has-file-got-valid-session-stamp call further 
has an iam parameter identifying the anti-vin^s process currently calling the session 
stamping process. 



1 40. The method of claim 37, wherein the has-file-got^yalid-session-stamp call further 

2 has a signer parameter, and further comprising: 

3 returning, by the session stamping process, an identifier fisq* the anti-virus process 

4 that last called the session stamping process as the signer parameter. 
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